I’m using Signal, but after I found out that it’s not as privacy-friendly as it claims, I’m uneasy about sharing my address there. I trust the person who asked for my address, but not the service. What’s a safe way to share? I was thinking of something like a self-destructing pastebin, but surely you have better ideas.
Which of Signals privacy claims are false?
Pretty much everything about it is unverifiable, because its a centralized service and you ultimately don’t know what the server is running. Contrast that with self-hostable apps which must pass verifiability checks, because people can host their own instance.
Clients are open source. Independent clients exists and they work. So the server must kind of do what signal claims, otherwise those devs would notice.
You have no idea what the server is running. It has your phone number, ie your real name and address, and it knows who you sent messages to.
Matrix and even Signal you reject for some reason work fine with no one being able to see the content of your message except the one you sent it to.
Signal is trustworthy
I guess you can use wormhole to transport the data to your peer, and if you’re extra paranoid encrypt it asymmetrically with something like age.
Then again you can just encrypt it with age and send it over Signal. There should be no risk involved in sharing public keys even if you don’t trust their servers.
Use briar.
https://1ty.me would be described as a “self-destruting pastebin.” I’d generally be careful about what you can put in there (e.g. put partial information in it with no context) but it seems to do the job.
But the real answer is probably PGP/GPG.
When I need extreme security and privacy, I use qTox
XMPP / Jabber with OMEMO encryption. Lots of free servers and clients.
